Label and review external sharing
A person checks a proposed sharing decision and its evidence.
Coming
See every demonstrationCONFIDENTIAL SITES PILOT
Find out who can reach your confidential sites before an AI tool does.
A label on a SharePoint site does not label the files inside it, and nobody has checked which people, links and groups can open the content the label was meant to protect. In four weeks we record the permissions and labels on the sites you choose, decide label and access with the content owners, test the protections on synthetic content with one cohort, and hand over the evidence.
01 Source02 Boundary03 Human decision04 Evidence
HOW IT WORKS
The control path in practice.
- Select the sites, the owners and a test cohort, and record the site access baseline for owner sign-off by the end of week one.
- Record permissions and labels on each site, then review the label and access decisions with the content owners.
- Test the approved protections on synthetic content with the cohort, checking file permissions, item labels and licensed protection features.
- Validate owner access and the exceptions, and hand over the runbook and the exception register.
THE PROBLEM
Why does a confidential site still leak?
Because a container label on a site says what the site is for; it does not apply a label or encryption to the files in it, and the sharing links and groups added over the years decide who can open them. An AI tool reads what the person can open, label or not.
The pilot treats site access and file protection as two separate decisions, each made with the content owner, because the misplaced confidence a container label creates is the finding we see most often. The cohort test checks actual file permissions, item labels and the licensed protection features, not the label on the door.
THE MICROSOFT INSIGHT
What does Microsoft 365 Copilot actually return?
Only content the signed-in person already has at least view permission to see, which means anything shared too widely is findable from the first day Copilot is switched on.
Microsoft 365 Copilot returns only content the signed-in user already has at least view permission to see, so anything shared too widely is findable from day one. (Microsoft Learn, checked Oct 31, 2026)
Check the sites before the cohort gets Copilot and the overshared folder is a fix on a list. Check them after and it is a quote in an answer.
THE METHOD
What happens in the four weeks?
A baseline, a decision matrix, a cohort test and a handover, each reviewed by you before acceptance.
- Week 0: select the sites, their owners and the test cohort.
- Week 1: record permissions and labels; by the end of the week the site access baseline is verified with owner sign-off.
- Week 2: review the label and access decisions with the owners and write the decision matrix.
- Week 3: test the approved protections on synthetic content with the cohort.
- Week 4: validate owner access and the exceptions, then hand over the runbook and the exception register.
THE NEW REACH
Which sharing does the tenant already report?
Since October 6, 2026 SharePoint Advanced Management reports item-level permissions granted to Everyone and to Everyone except external users, which is the first list the baseline reads.
Since October 6, 2026 SharePoint Advanced Management reports item-level permissions granted to Everyone and to Everyone except external users. (Microsoft Learn, checked Nov 4, 2026)
Read that report in week one and the broadest shares are rows with an owner. Skip it and they are the first thing a pilot user finds.
WHAT IT IS NOT
Does the pilot relabel the tenant?
No. It covers the sites you select and one cohort. Tenant-wide relabeling, remediation of every legacy share and legal classification advice are out of scope and recorded as next steps with an owner.
Named site owners, supported labels and synthetic test content are needed. Access is through named accounts your team creates, in one security group with least-privilege roles, activated through Privileged Identity Management in agreed change windows and removed at closeout; the Purview Information Protection role group covers the approved label work and SharePoint administration is scoped to the pilot sites.
AFTER TWO WEEKS
What will be working after two weeks?
- You hold a site and permission baseline for the selected sites, verified with the owners.
- You hold a label and access decision matrix, one row per site, signed by the content owner.
- The cohort test evidence shows what the approved protections did on synthetic content.
- You hold the owner runbook and the exception register, reviewed before acceptance.
The work is delivered remotely inside your own Microsoft tenant, wherever your business is, and on site only when the work needs it.
HONEST ABOUT LIMITS
What this does not do yet
It does not keep a site out of Copilot answers by itself. Restricted Content Discovery in SharePoint keeps a chosen site out of organization-wide search and Microsoft 365 Copilot answers while its permissions are reviewed, without changing who can open the files; Restricted SharePoint Search is retiring and new enablement has been blocked since July 31, 2026. (Microsoft Learn, checked Nov 1, 2026) Restricted Content Discovery keeps a chosen site out of organization-wide search and Copilot answers while its permissions are reviewed, without changing who can open the files; the pilot uses it on the sites under review and records when it comes off.
It does not relabel the tenant or fix every legacy share: those are scoped separately once the matrix exists.
It does not give legal classification advice; the owner decides what is confidential.
THE ONE THING TO REMEMBER
Check site labels and file protection separately.
Said another way: the label on the door and the lock on the file are two decisions with two owners.
Said a third way: a cohort test on synthetic content proves the protection; a label proves the intent.
SHOW YOUR WORK
See the control path on a fictional bank.
DIRECT ANSWERS
Questions before you decide.
How many sites can the pilot cover?
The sites you select with their owners, enough to prove the decision matrix with one cohort. The matrix and the runbook are what scale afterward; a wider wave is scoped from them.
Do you need Global Administrator?
No. Named accounts your team creates, in one security group with least-privilege roles, activated through Privileged Identity Management during agreed change windows and removed at closeout. Label work uses the Purview Information Protection role group.
What is tested with the cohort?
Actual file permissions, item labels and the licensed protection features on synthetic content, so the evidence shows what the protection did, not what the site label implied.
Does this help in an acquisition?
Yes. Testing the acquired company's confidential sites before its people or agents get broad access is the same four weeks on a different set of sites.
How is it priced?
Quoted after a scoping call and fixed in a signed statement of work; Microsoft licenses and consumption are separate. The Microsoft Marketplace listing is pending; until it is live the engagement is quoted directly. No price appears on this site.
NEXT STEP
Start with a boundary you can explain.
Choose a focused check, or speak with the team about the workflow you need to improve.